System and method for discriminating nature of communication traffic transmitted through network based on envelope characteristics

Abstract

A system and method are provided for discriminating the nature of traffic flowing through a computer network. Various types of traffic are distinguished. For example, traffic sourced by a software application that generates them may be distinguished. The problem of detecting malicious traffic either originating outside a target network, or inside a target network from a compromised computer is addressed, as is the problem of distinguishing malicious traffic from legitimate web surfing or other applications activity. Traffic distinctions are made based on signal envelope characteristics in such manner as to preserve robust performance even when the subject traffic is encrypted.

Description

RELATED APPLICATION DATA[0001]This Application is a Continuation-In-Part of co-pending patent application Ser. No. 13 / 665,916 filed 31 Oct. 2012, which is based on Provisional Patent Application No. 61 / 553,944, filed 31 Oct. 2011. This Application is also based on Provisional Patent Application No. 61 / 791,028, filed 15 Mar. 2013.BACKGROUND OF THE INVENTION[0002]The present invention is directed to a system and method for discriminating the actual origination of communication signals transmitted through a network interconnection. More specifically, the system and method are directed to the processing of communication signals received at a local, or reference, site through a network interconnection to determine and / or uniquely characterize the remote site origination of such communication signals. The system and method provide for this determination and / or unique characterization in a manner that is signal payload-agnostic, or data content-agnostic, manner. They do so by, among other ...

AI Technical Summary

Benefits of technology

The invention allows for the automatic and accurate identification of the sources of communication signals in a network interconnection. This can be done by analyzing the envelope information of the signals, regardless of their data content. This allows for the accurate identification of remote sites that are sending signals through the network, and the classification of those signals based on their origination points.

Problems solved by technology

Where a site in question is uncooperative with the monitoring measures in place, is deliberately evasive to such monitoring, or is particularly sensitive to privacy concerns, the site may employ encryption measures in the given communication channel to make it difficult or impractical to determine its identity based on the payload of data.

Even in cases where clear-channel data is readily accessible, it may become computationally challenging to store and process necessary data signatures when there are potentially many cases of interest.

Images